General

  • Target

    44ef0d52e033d3e952b96545fa1a82a0_NeikiAnalytics

  • Size

    951KB

  • Sample

    240509-qm4mnaee84

  • MD5

    44ef0d52e033d3e952b96545fa1a82a0

  • SHA1

    6f91210721ad4cff0379c2e9fe88c8ed3943a9b9

  • SHA256

    27a4404a7f0e8fe3c82b6cd82886e0a8418e03bce4bb152c9d9cfe2b929f2125

  • SHA512

    e83f4ca6181fc48ad40aa5950edc59ca47068d1ebf33f644dfee6404bf5ba6f83358d37480f7b14830c37d5729fd9e3369c02c938000159d0e3956d5e62a9d5b

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5I:Rh+ZkldDPK8YaKjI

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      44ef0d52e033d3e952b96545fa1a82a0_NeikiAnalytics

    • Size

      951KB

    • MD5

      44ef0d52e033d3e952b96545fa1a82a0

    • SHA1

      6f91210721ad4cff0379c2e9fe88c8ed3943a9b9

    • SHA256

      27a4404a7f0e8fe3c82b6cd82886e0a8418e03bce4bb152c9d9cfe2b929f2125

    • SHA512

      e83f4ca6181fc48ad40aa5950edc59ca47068d1ebf33f644dfee6404bf5ba6f83358d37480f7b14830c37d5729fd9e3369c02c938000159d0e3956d5e62a9d5b

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5I:Rh+ZkldDPK8YaKjI

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks